> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# How to investigate risk factors

> Investigate risk factors affecting an endpoint, review available technical details, and understand the underlying conditions or activities that caused a risk to be detected.

## Procedure

1. Open the  [Endpoints page](/docs/espm/endpoints/endpoints-page)  or select an endpoint directly from a  [Dashboard](/docs/espm/dashboards-page)  widget.
2. Click the endpoint you want to investigate.
3. The  [Endpoint details](/docs/espm/endpoints/endpoint-details) page opens.
4. Navigate to the **Risk Factors** grid.
5. Locate the risk factor you want to analyze:
   * Use filtering or sorting to quickly find a specific risk factor.
   * By default, only  [active](/docs/espm/about-risk-factors#active)  risk factors are displayed.
6. Expand the risk factor to view additional details.
7. Review the available technical details to determine the cause of the risk. Depending on the risk factor, details may include information such as:
   * Process names
   * User names
   * Browser extension or add-on names
   * Browser profiles
   * Security event information
   * Configuration details
   * Device or application identifiers
   * and more.
   <Note>
     Some risk factors provide extensive diagnostic information, while others may contain minimal details when the cause is self-explanatory.
   </Note>
8. Review the [Remediation](/docs/espm/riskfactors/recommend-and-remedy) section associated with the risk factor.
9. Follow the recommended remediation steps to resolve the issue.
10. After the endpoint reports updated probe results, the risk factor status and associated health scores are automatically updated.

## Key Considerations

* Technical details help identify the exact source of the risk and are often the fastest way to determine the required remediation action.
* Not all risk factors provide the same level of detail. The amount of information available depends on the type of risk and the data collected by the corresponding probe.
* Risk factors with the highest **Risk Score** should generally be investigated and remediated first, as they have the greatest impact on endpoint, policy, and system health.
* If additional information is required, open the  [Risk factor details](/docs/espm/riskfactors/risk-factors-details)  page to review the full risk description, control mappings, and remediation guidance.

## Related

<CardGroup cols={2}>
  <Card title="How to prevent risk recurrence" icon="workflow" href="/docs/espm/howto/how-to-avoid-risk-re-appearing">
    Learn how to prevent remediated risks from reoccurring by implementing recommended configurations, security controls, and user awareness practices.
  </Card>

  <Card title="How to investigate and remediate event-based risks" icon="workflow" href="/docs/espm/howto/how-to-remediate-event-based-risk-factors">
    Investigate event-based risk factors and implement corrective actions to eliminate their root cause and reduce the likelihood of recurrence.
  </Card>
</CardGroup>